Phishing-Resistant MFA: Why Text-Message Codes Are No Longer Enough

Multi-factor authentication is one of the most effective security controls an organization can turn on. But not all MFA is equal. The six-digit code sent by text message, still the default for many organizations, is increasingly easy for attackers to get around. If your staff handle patient information, donor data or financial systems, it’s time to look at phishing-resistant options.

Why codes and push prompts aren’t enough

Traditional MFA assumes that an attacker who steals a password still can’t produce the second factor. That assumption no longer holds:

• Phishing proxies sit between the user and the real sign-in page. The user types their password and code into what looks like the normal login screen, and the attacker relays both in real time to capture a valid session.
• SIM swapping lets an attacker move a victim’s phone number to a new SIM card and receive their text-message codes directly.
• Push fatigue works by sending approval prompts over and over until a tired or distracted user taps “Approve” just to make them stop.

None of these attacks require breaking any encryption. They rely on tricking people, which is why the fix is a method that can’t be tricked.

What “phishing-resistant” means

Phishing-resistant MFA ties the sign-in to the real website or app using cryptography. Even if a user is fooled into visiting a fake page, there’s nothing they can type or approve that the attacker can reuse. The main options are:

• Passkeys and FIDO2 security keys, which use a hardware key or the secure chip in a phone or laptop.
• Windows Hello for Business, which signs users in with a PIN or biometric tied to their specific device.
• Certificate-based authentication, common in larger or regulated environments.

Government security agencies, including CISA in the United States, recommend phishing-resistant MFA as the strongest form of authentication available.

A practical path to get there

You don’t have to switch everyone overnight. A phased approach works well:

1. Stop the weakest methods first. Move users off text-message and voice-call codes. If you use an authenticator app, turn on number matching so users have to type a number shown on screen rather than simply tapping approve.
2. Protect your highest-risk accounts. Give administrators, executives, finance staff and anyone with access to sensitive records phishing-resistant methods first.
3. Use conditional access. Require stronger sign-in methods for sensitive applications and for access from unfamiliar devices or locations.
4. Plan for lost devices. Set up a clear, verified recovery process so a lost phone or key doesn’t become a help-desk crisis or a social-engineering opening.
5. Expand to everyone. Once the process is proven, roll it out organization-wide with simple instructions and hands-on help.

The bottom line

Any MFA is far better than none. But attackers have adapted, and the methods most organizations rely on can now be bypassed with tools that are cheap and widely available. Moving to phishing-resistant sign-in, starting with your most important accounts, closes one of the most common doors into an organization.

Want help planning a stronger sign-in strategy? Explore our cybersecurity services.